Lucene search

Alpine Linux Development TeamALPINE:CVE-2021-40824

HistorySep 13, 2021 - 7:15 p.m.

CVE-2021-40824

2021-09-1319:15:19

Alpine Linux Development Team

security.alpinelinux.org

cve-2021-40824

logic error

room key sharing

element android

matrix sdk for android

encryption keys

matrix homeserver

crafted messages

end-to-end encryption

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

36.0%

JSON

A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 (aka Matrix SDK for Android) before 1.2.2 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the attacker to decrypt end-to-end encrypted messages sent by affected clients.

OSVersionArchitecturePackageVersionFilename
Alpineedge-communitynoarchelement-web< 1.8.4-r0UNKNOWN
Alpine3.14-communitynoarchriot-web< 1.8.4-r0UNKNOWN
Alpine3.15-communitynoarchriot-web< 1.8.4-r0UNKNOWN
Alpine3.16-communitynoarchriot-web< 1.8.4-r0UNKNOWN
Alpine3.17-communitynoarchriot-web< 1.8.4-r0UNKNOWN
Alpine3.18-communitynoarchelement-web< 1.8.4-r0UNKNOWN
Alpine3.19-communitynoarchelement-web< 1.8.4-r0UNKNOWN
Alpine3.20-communitynoarchelement-web< 1.8.4-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	edge-community	noarch	element-web	< 1.8.4-r0	UNKNOWN
Alpine	3.14-community	noarch	riot-web	< 1.8.4-r0	UNKNOWN
Alpine	3.15-community	noarch	riot-web	< 1.8.4-r0	UNKNOWN
Alpine	3.16-community	noarch	riot-web	< 1.8.4-r0	UNKNOWN
Alpine	3.17-community	noarch	riot-web	< 1.8.4-r0	UNKNOWN
Alpine	3.18-community	noarch	element-web	< 1.8.4-r0	UNKNOWN
Alpine	3.19-community	noarch	element-web	< 1.8.4-r0	UNKNOWN
Alpine	3.20-community	noarch	element-web	< 1.8.4-r0	UNKNOWN

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

36.0%

JSON

Related for ALPINE:CVE-2021-40824